MalwareFinancial ServicesFinanceRansomwareVulnerability ExploitLockBitLockBit 3.xData ExfiltratedData EncryptedRansom DemandedTargetedIdentity (basic)Government IDFinancial accountHighContained

PLANET HOME LENDING, LLC

bd_423f0bb984a52f1a · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 15, 2023

Filed

Feb 9, 2024

To disclose

12 weeks

Affected

3,846state residents only

Linked

12 records

Confidence

66%

Full breach record for PLANET HOME LENDING, LLC →3 incidents on file

Planet Home Lending, LLC notified South Carolina residents of a ransomware incident involving the LockBit threat actor. The attack exploited the 'Citrix Bleed' vulnerability in a Citrix software product on November 15, 2023. The incident resulted in the unauthorized access of a read-only data folder containing customer loan files with PII, including SSNs and financial account numbers. The company engaged forensic investigators, notified the FBI, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due12 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 12 weeks / 86 days

Nov 15, 2023

Begins

Nov 15, 2023

Discovered

Feb 9, 2024

Filed

vs. sector median

+4 wks slower

This filing is one of 12 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Maine State AGbd_4a3e4f75012222042024-02-09Verified by operator
California State AGLockBitbd_83e14e9833c126bd2024-02-09Verified by operator
Oregon State AGbd_8d3bd14ff0d366f52024-02-09Verified
Massachusetts State AGbd_d2c2e4d0b9213d3d2024-02-15 · +6dVerified

Show 6 more filings ↓up to 39d gap

Maine State AGbd_6a67d4bb7edefa9b2024-01-26 · +14dVerified by operator
Delaware State AGLockBitbd_9a07f8813460f7912024-01-25 · +15dVerified by operator
Indiana State AGbd_ea73c1985b4e24ab2024-01-25 · +15dVerified by operator
Montana State AGLockBitbd_36716702cdea2f822024-01-24 · +16dVerified
Washington State AGLockBitbd_6076d03c1a327fbb2024-01-23 · +17dVerified by operator
Illinois State AGbd_0106377049ce366d2024-01-01 · +39dVerified by operator

Showing first 10 of 11 linked disclosures.

Name: PLANET HOME LENDING, LLC
norm: planet home lending
Domain: planethomelending.com

Name: PLANET HOME LENDING, LLC
norm: planet home lending
Domain: planethomelending.com
Industry: Financial Servicesllm

Discovered: Nov 15, 2023
Breach occurred: Nov 15, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 24, 2024
Affected individuals: 3,846state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access· LockBit
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: LockBitExternalFinancial
Regulator citations: Notified the FBI
Initial access: exploit_public_facing

During the incident: Secured our environment
Conducted a full forensic investigation
Notified the FBI
Offering you access to 24 months of complimentary credit monitoring and identity protection services through Experian’s IdentityWorks
Changes made: Implemented additional technical safeguards
Retaining a third-party consultant to perform a complete audit and risk assessment of Planet’s information security technology, controls and processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Washington State AG+22d

Montana State AG+23d

Delaware State AG+24d

Indiana State AG+24d

Maine State AG+25d

Maine State AG+39d

California State AG+39d

Oregon State AG+39d

South Carolina State AG+39d · this page

Massachusetts State AG+45d

Pattern: first filing Jan 1 (IL), last Feb 15 (MA) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/PlanetHomeLendingLLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2024
Raw hash: e67414a6907d6e3807b89dc993f88203d5775504db9af706d8ca1c23366e5b72

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPLANET HOME LENDING, LLC

Victim entityPLANET HOME LENDING, LLC

Incidentdiscovered Nov 15, 2023

Stated responseSecured our environment

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov